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Abstract 

In  this  paper  we  pose  and  begin  to  explore  a  deductive  problem  more  general 
than  that  of  finding  a  proof  that  a  given  goal  formula  logically  follows  from  a 
given  set  of  hypotheses.  The  problem  is  most  simply  stated  in  the  propositional 
calculus:  given  a  goal  A  and  hypothesis  H  we  wish  to  find  a  formula  P,  called  a 
precondition,  such  that  A  logically  follows  from  P  A  H.  A  precondition  pro¬ 
vides  any  additional  conditions  under  which  A  can  be  shown  to  follow  from  H.  A 
slightly  more  complex  definition  of  preconditions  in  a  first-order  theory  is 
given  and  used  throughout  the  paper.  A  formal  system  based  on  natural  deduction 
is  presented  in  which  preconditions  can  be  derived.  A  number  of  examples  are 
then  given  which  show  how  derived  preconditions  are  used  in  a  program  synthesis 
method  we  are  developing.  These  uses  include  theorem  proving,  formula  simplifi¬ 
cation,  simple  code  generation,  the  completion  of  partial  specifications  for  a 
3ubalgorithm,  and  other  tasks  of  a  deductive  nature. 

0.  Introduction 

Traditionally,  the  subject  of  automatic  theorem  proving  has  dealt  with  the 
problem  of  finding  a  proof  that  a  given  goal  formula  A  logically  follows  from  a 

*  The  work  reported  herein  was  supported  by  the  Foundation  Research  Program 
of  the  Naval  Postgraduate  School  with  funds  provided  by  the  Chief  of  .laval 
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given  hypothesis  H.  In  this  paper  we  pose  a  more  general  deductive  problem  and 
suggest  that  systems  for  solving  this  more  general  problem  can  extend  the  util¬ 
ity  of  deductive  mechanisms,  and  provide  a  framework  for  overcoming  some  prob¬ 
lematic  features  of  current  theorem  provers.  The  problem  is  most  simply  stated 
in  the  propositional  calculus:  given  a  goal  A  and  hypothesis  li  we  wish  to  find  a 
formula  P,  called  a  precondition,  such  that  A  logically  follows  from  P  A  H.  In 
other  words  a  precondition  provides  any  additional  conditions  under  which  A  can 
be  shown  to  follow  from  H. 

A  formal  system  in  which  preconditions  can  be  derived  is  described  in  sec¬ 
tion  2.  Each  rule  in  this  natural  deduction-like  system  has  a  reduction  com¬ 
ponent  which  reduces  a  goal  Aq  to  subgoals  , A2 ,  •  •  • , Aik  and  a  composition  com¬ 
ponent  which  composes  preconditions  of  subgoals  A1 ,Ao, . • • .A^  to  form  a  precondi¬ 
tion  of  Aq. 

After  presenting  basic  terminology  in  section  1  a  formal  system  for  deriv¬ 
ing  preconditions  is  given  in  section  2.  A  number  of  examples  are  presented  in 
section  3  which  show  how  derived  preconditions  are  used  in  a  program  synthesis 
method  we  are  developing  [9. 10].  These  uses  include  theorem  proving,  formula 
simplification,  simple  code  generation,  the  completion  of  partial  specifications 
for  a  subalgorithm,  and  other  tasks  of  a  deductive  nature. 

1 .  Terminology 

The  examples  given  below  are  drawn  from  a  program  synthesis  system  which 
works  within  a  nany-sorted  first-order  theory  TT.  The  theory  includes  data 
types  such  as  II  (natural  numbers),  LIST(H)  (linear  lists  of  natural  numbers), 
and  BAGS ( II )  (multisets  of  natural  numbers).  We  will  use  the  (possibly  sub¬ 
scripted)  symbols  i,j,k  for  variables  ranging  over  II ,  x,y,z  for  variables  over 
LIST(  II ) ,  and  3  as  a  variable  over  BAGS(  II ) .  The  theory  also  includes  a  number 
of  functions  and  predicates  defined  on  these  types  and  axiomatic  specifications 
of  their  interactions.  The  notions  of  term,  atomic  formula,  literal,  and 
(well-formed)  formula  have  their  usual  definitions  [5]-  Let  T  and  P  be  proposi¬ 
tional  constants  which  have  the  values  true  and  false  respectively  in  all  models 
of  TT.  We  make  use  of  a  distinguished  subset  of  the  theorems  of  TT  called  known 
theorems  which  are  assumed  to  be  immediately  available  to  the  deductive  system. 
The  set  of  known  theorems  may  change  over  time  but  initially  includes  all  axioms 
of  TT.  All  of  the  known  theorems  required  by  the  examples  are  listed  in  the 
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appendix. 

Let  Q1x1  Q2x2...Qnxn  ^  be  a  closed  fomrala  not  necessarily  in  prenex  form 
where  is  either  3  or  V  for  i=1,2,...,n.  A  Xj Xp» •  ^-precondition  of 
Q1  x-j  Q2x2...Qnxn  ®  *s  a  quantifier-free  formula  P  dependent  only  on  variables 
xi,x2,...,xn  such  that 

Ql xi Q2x2*--Qnxn[  ] 

is  valid  in  TT.  P  is  also  a  weakest  x^  x2-  .  ^-precondition  if 

®1X1®2X2** 1 

is  valid  in  TT. 

Two  well-known  special  cases  of  these  concepts  can  be  given.  First,  if  T 
can  be  derived  as  a  x1x2- •  ^-precondition  of  a  goal  x^  Q2x2*’*®nxn  G  1:1:1611  the 
derivation  is  in  fact  a  proof  of  the  validity  of  Q1x1  Q2x2'-,(^nxn  5  since 

Q1x1Q2x2**‘Qnxn  [T=^G]  “  Q1X1Q2X2*  * ‘VSi  G 

Therefore  any  system  for  deriving  preconditions  can  also  be  used  for  theorem 
proving.  Second,  Dijkstra's  concept  [3]  of  a  "weakest  pre-condition"  WP(S,R)  of 
a  program  S  with  respect  to  post-condition  R  may  be  defined  as  a  weakest  q- 
precondition  of 

Vq3k3p[  TERMINATE(S,q,k,p)  A  R(p))  ] 

where  TERMITIATE(S,q,k,p)  holds  iff  program  S  activated  in  initial  state  q  ter¬ 
minates  within  k  steps  (assuming  a  suitable  definition  of  a  program  step)  in  a 
final  state  p.  I.e., 

V q[  WP(S,R)[q]  -  3k 3p  TERMINATE(S,q,k,p)  A  R(p)  ] 

On*  program  synthesis  method  is  not  directly  related  to  Dijkstra's  approach  to 
algorithm  design  [3]. 

In  general  a  given  goal  may  have  many  preconditions.  Characteristics  of  a 
useful  precondition  seem  to  depend  on  the  application  domain.  In  program  syn¬ 
thesis  we  generally  want  preconditions  which  are  a)  easily  computable,  b)  in  as 
simple  a  form  as  possible,  and  c)  as  weak  as  possible.  (Criterion  (c)  prevents 
the  boolean  constant  F  from  being  an  acceptable  precondition  for  all  goals.) 
Clearly  there  is  a  tradeoff  between  these  criteria.  We  are  currently  investi- 
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gating  the  possibility  of  measuring  each  criterion  by  a  separate  heuristic  func¬ 
tion,  then  combining  the  results  to  form  a  net  complexity  measure  on  precondi¬ 
tions.  For  reasons  to  be  discussed  later  we  assume  that  such  a  complexity  meas¬ 
ure  ranges  over  a  well-founded  set  (such  as  H  'under  the  usual  <  relation)  and 
that  we  seek  to  minimize  complexity  over  all  preconditions.  In  this  paper  how¬ 
ever  we  are  mostly  concerned  with  setting  up  a  formal  system  within  which 
preconditions  can  be  derived,  and  showing  how  to  solve  some  program  synthesis 
problems  using  it. 


2.  A  Formal  System  for  Deriving  Preconditions 
2.1_  Goal  Preparation 

In  presenting  a  set  of  rules  which  allow  us  to  derive  preconditions  we  use 
the  notation  ^  to  denote  the  statement  that  well-formed  formula  A  logically  fol¬ 
lows  from  the  set  of  hypotheses  H  in  TT,  i.e.,  ^  A  ^  A  •••  A  ^  A  is 

valid  in  TT  where  H  =  {fy ,h2« . . .h^} . 

A  goal  statement  ^  and  the  known  theorems  of  TT  are  prepared  as  follows. 
First,  all  occurences  of  equivalence  (as)  and  implication  ( =»  )  signs  are  elim¬ 
inated  and  negation  signs  are  moved  in  as  far  as  possible.  H  and  the  known 
theorems  of  TT  are  then  skolemized  in  the  usual  way  [5],  i.e.,  existentially 
quantified  variables  are  replaced  by  skolem  functions  of  the  universally  quanti¬ 
fied  variables  on  which  they  depend.  Quantifiers  are  then  dropped  with  the 
understanding  that  all  remaining  variables  are  universally  quantified.  The  goal 
A  is  skolemized  in  a  dual  manner  with  universally  quantified  variables  replaced 
by  skolem  functions  of  the  existential  variables  on  which  they  depend.  All 
quantifiers  are  then  dropped  with  the  understanding  that  all  variables  in  A 
which  remain  are  existentially  quantified.  The  preparation  of  A  is  equivalent 
(via  duality  of  goals  and  assertions)  to  preparing  ~A  as  an  hypothesis  then  tak¬ 
ing  the  negation  of  the  result  as  our  prepared  goal. 

2.2  Reduction/Composition  Rules 

Rules  which  reduce  a  goal  statement  to  two  subgoal  statements  are  expressed 
in  the  following  form: 
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<po>  „o  e0 


<p1  >  a1  e1 


A2  @2 


where  Aq,Aj ,  and  A2  are  goal  formulas,  Hq,  31 ,  and  H2  are  sets  of  hypotheses, 
©q,  0-| ,  and  0o  are  substitutions,  Pq,  P^ ,  and  ?2  are  formulas  (the  derived 
preconditions),  and  0  is  either  V  or  A-  A  rule  of  this  form  asserts  that  if 
Pj_  is  a  (weakest)  precondition  of  H^0^  Aj©^  where  i=1 ,2  then  Pq  is  a  (weak¬ 
est)  precondition  of  Hq0q  =»  Aq0q.  Pq  generally  is  P^  ®  P2*  Substitution  0q 
is  formed  from  substitutions  0-]  and  ©2  in  ways  that  depend  on  0. 

If  ©  is  A  then  0q  is  the  unifying  composition  of  ©1  and  ©2»  denoted  uc(©^ , 
©2)  If  ©q  =  uc(©1  ,©2)  then  ©q  is  a  most  general  substitution  such  that  for 
any  literal  L 

(I&l )©q  =  (LQq)^  =  IBq  =  (L©2)0O  =  (L©q)©2. 
uc(©1 ,©2)  may  be  computed  by  finding  the  most  general  unifier  of 

» •  •  •  *tn''tn+1 » * ' '  ’V+ffl) 


(v,,...,vn,v 


n,vn+1 'vn+m 


where 


=  {t1/v1,...,tn/vn} 

®2  =  ^  ^n+1  /vn+1 » *  *  • » ’*'n+a/vn-Hn^  * 

If  these  expressions  cannot  be  unified  then  the  result  is  a  special  atom  NIL. 
For  example, 

uc({a/z},{b/zj)  =  NIL 
uc( { } , fa/z} )  =  [a/z\ 
uc( jf(x)/z} , if(a)/z) )  =  if(a)/z,a/x( 

If  0  is  V  "then  is  formed  by  the  disjunctive  composition  of  P1 ,  ©1 ,  ?2 

and  ©2*  which  i3  denoted  dc(?^ ,9^ ,?2»©2) •  The  disjunctive  composition  may  be 
computed  as  follows  assuming  that  the  derived  preconditions  P.  and  ?2  contain  no 


variables.  let  jS-j  ,S2, .  •  •  ,S^}  be  the  set  of  skolem  function  names  in  P1  which 
come  from  the  top  level  goal  in  the  current  deduction.  For  example  if  the  top 
level  goal  is  Q(u,f^(u))  =»  R(x,f2(x) ,f3)  and  is  W(f^  (fj)  )  ^hen 

{f| ,f.  }  is  the  set  of  skolem  function  names  in  P^  which  comes  from  the  top  level 
goal.  Let  P1 (y1 , . . . ,y^)  be  the  formula  resulting  from  the  replacement  of  each 
occurence  of  skolem  function  Sj  by  variable  y^  in  P-j .  In  the  above  example 
Pi  (y1fy2)  denotes  W(y1  ,g2(y2))*  Function  dc  is  defined  as  follows. 

dc(P1 ,01  ,?2,©2^  =  9i=KIL  and  ©2=NIL  then  NIL 
else  if  P^=T  or  ©2=NH  then  0^ 
else  if  P2=T  or  0-,=NIL  then  ©2 
else  if  9^  =  { i  then  ©2 

else  jhx(S1  ,S2,  ...,Sm)/x  !  t/x6©1  or  t/x€02} 

where 

hx(y1 ,  •  •  •  ,ym)  =  if  P1(yv...fym)  then  x©1  else  x©2- 

Loosely  speaking,  the  disjunctive  composition  of  P1 ,01  ,P2,  and  ©2  behaves  like 
©1  when  P1  holds  and  behaves  like  ©2  otherwise.  Some  examples: 

dc(a0>3,  |f1(aQ)/x},  T,  {a^x})  =  \a^/x] 

dc(f1>f2(f1),  \ti/z,t2{tj)/x\,  {f2(f1)/z,f3/x!) 

=  |hz(f^  ,f2,f-3;)/z,  h^fj  ,f2,f3)/x| 

where 

hz(yi  ,72'7y!  =  if  71  >72  then  7i  else  y2 
hx(y1  ,y2,y-})  =  if  7i  >y2  then  72  else 

A  complete  deduction  involving  a  disjunctive  composition  is  given  in  section 
2.5. 


Rules  which  reduce  a  goal  statement  to  one  subgoal  are  notated 

<?0>  Aq  90 

% 


<P1  >  Ai  ©1 
*1 


-o- 


Occasionally,  as  in  the  application  of  known  theorems  which  are  implica¬ 
tions,  the  relation  between  goal  and  subgoals  is  not  one  of  equivalence  but 
implication.  Rules  of  this  kind  are  notated. 


<P0>  Aq  ©o 

% 

t 

<?!  >  A1  91 
Hi 


which  asserts  that  if  P-j  is  a  precondition  of  H1©1  =»  then  Pq  is  a  precon¬ 

dition  of  Hq0q  =»  Aq0.  For  rules  of  this  kind  we  cannot  assert  that  Pg  is  a 
weakest  precondition  of  Hg©g  =?>  AqSq  even  if  is  known  to  be  a  weakest 

precondition  of  A-jG^ . 

The  following  rules  are  for  the  most  part  extensions  of  typical  goal  reduc¬ 
tion  rules  [2,5,8]. 

R1 .  Reduction  of  Conjunctive  Goals 


A  ?2>  A  A  B  uc(©1  ,©2) 
H 


<p^  a  et 


R2.  Reduction  of  Disjunctive  Goals 


<P2>  B  e2 


<p1  V  ?2>  a  V  b  dc(p1  ,e1  ,?2,e2) 
H 


<Pi  >  A  0, 


<P2>  B  ©2 


H3 .  Reduction  of  Conjunctive  Hypotheses 


,<py  a,  9 
{B  A  c}  UH 


<p<  v  p2>  a  dc(p1  ,e1  ,P2,e2) 
SB  A  c}  UH 


<P, >  A  S1  <Pp>  A  9p 

{Bf  UH  1 C |  UH 


R4-  Reduction  of  Disjunctive  Hypotheses 


<p1  A  p?>  A  uc(e1,e2) 

{B  V  Cl  UH 


<P1  >  A  6-j  <Pp>  A  02 

1B)UH  1C}  UK 


R5-  Application  of  an  Equivalence  Formula 


<P> 


<?> 


A  991 
H 

C  =  B  is  a  known  theorem  of  Tf 
or  an  hypothesis  in  H  and  9  unifies  (A, 3} 

39  9., 

H 


R6.  Application  of  an  Implications!  Formula 


<P>  A  991 
H 


* 


<P>  D  0! 
H9 


if  C  3  is  a  known  theorem  of  TT  or  hypothesis  in  H, 
and  D  is  C9  where  9  unifies  { A,B } 
or  D  is  ~B9  where  9  unifies  { A , ~C }  or  j~A,C) 


K7.  Forward  Inference  from  an  Hypothesis 

<P>  ,  A  e 
(B)  UH 

if  D=»E  or  DaiS  is  a  known  theorem  of  TT 
or  hypothesis  in  H  and  6^  unifies  {B,D| 


R8.  Goal/Hypothesis  Duality  rules 

R8a 

<P>  »B  V  A  6 

H 

<P>  ,  A  e  <P>  ~B  v  A  0 

13}  UH  H 

R9.  Substitution  of  Equal  Terms 


R8b 


<P> 

(B 


a  e 

UH 


<P>  A(r)  0 
H 

<P>  A(s)  9 


if  r=s  is  an  hypothesis  in  H 
or  a  known  theorem  of  TT 


RIO.  Conditional  Equality  Substitution 


<v 


<P1  A?2>  A(r)  uc(e1  ,e2) 
H 


A(s2)6q  9i  <P2>  36q 
H90  H60 


if  3  =»  =  32  is  an  hypothesis 
a  known  theorem  and  9 q  unifies  1 r , } 
e2 


2.3  Primitive  Coals 

There  are  several  types  of  primitive  goal  statements  in  our  system.  Each 
are  described  by  notations  of  the  form  h  ^  which  assert  that  ?  is  a 
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precondition  of  H©  A 6  if  the  associated  condition  holds. 


PI . 


<T>  A  © 
H 


if  6  unifies  |A,B(  where  B  is  a  known  theorem  of  TT  or  B6E 


P2. 


<P>  A  NIL 


if  ©  unifies  (A,~B|  or  |~A,B},  where  B  is  a  known  theorem  of 


In  addition  to  PI  and  P2  any  goal  with  a  null  hypothesis  may  be  taken  as  primi¬ 
tive: 


p=5  <A'>  A  {} 

P5.  j} 


.k,  .m. 

if  A  has  the  form  V  and  A'  has  the  form  V  A,-  where 
i=1  j=1  j 

!Ai-5j=1,m  c  { A± } i_i and  for  each  j,  1<j<m,  A^  depends 
3  3 

on  the  variables  x^Xp,...,^  only  when  we  seek  a 

x-j  ,X2»  •  •  •  ,xn-precondition. 


Primitive  goals  of  type  PI  and  P2  yield  weakest  preconditions  but  in  general 
primitive  goals  of  type  F3  do  not.  Note  that  any  goal  statement  can  be  con¬ 
verted  to  an  equivalent  goal  with  a  null  hypothesis  by  repeated  applications  of 
rule  RSb. 


2.4  The  Deduction  Process 

The  derivation  of  a  precondition  of  goal  statement  4  can  be  described  by  a 
two  stage  process.  In  the  first  phase  rules  are  repeatedly  applied  to  goals 
reducing  them  to  subgoals  and  generating  a  goal  tree.  Rules  are  not  applied  to 
a  goal  satisfying  the  primitive  goal  tests  PI  and  P2  or  if  the  goal  has  been 
specially  converted  to  satisfy  73 .  If  for  some  reason,  such  as  limits  on  compu¬ 
tational  resource,  it  is  desired  to  terminate  the  reduction  process  before  all 
subgoals  have  been  reduced  to  primitive  goals  of  type  PI  or  P2,  then  any 
subgoals  waiting  for  rule  application  can  be  converted  to  a  primitive  goal  of 
type  F3-  The  result  of  this  reduction  process  is  a  goal  tree  with  primitive 
goals  as  leaf  nodes. 

The  second  phase  involves  the  bottom-up  composition  of  preconditions  and 
substitutions.  Initially  each  primitive  goal  yields  a  precondition  and  a  sub¬ 
stitution.  Subsequently  whenever  a  precondition  or  substitution  has  been  found 
for  each  3Ubgoal  of  a  goal  4  then  a  precondition  and  substitution  is  composed 
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for  tj  according  to  the  reduction/composition  rule  employed.  Each  newly  composed 
precondition  is  then  run  through  a  simplification  process  to  be  described  later. 

Usually  several  rules  can  be  applied  to  a  given  goal  and  each  rule  will 
generate  a  precondition.  In  an  computer  implementation  of  this  system  we  would 
make  use  of  a  complexity  measuring  function  and  select  that  precondition  of 
least  complexity  among  the  alternatives. 

2.5  An  Example 

As  an  example  of  the  use  of  this  system  suppose  that  we  wish  to  show  that 

V i()V ii  3i2[(i-o<'^1  A  V  A  i2=1)l  (0 

is  valid  in  TT  where  inA-pip  are  variables  over  II  (natural  numbers).  We  do 
so  by  trying  to  derive  T  as  a  iQi1 i2-precondition  of  (1).  The  goal  after 
preparation  is: 

(r0<ri  A  i2=°)  V  (r^r,  A  i2  =D 

where  Tq  and  r-j  are  skolem  constants  of  type  JJ .  The  derivation  is  depicted 
below  in  figure  1 .  Initially  ( 1 )  is  reduced  via  rule  R2  to  two  subgoals  then 
each  of  these  subgoals  are  reduced  via  rule  R1  to  two  other  subgoals.  Subgoals 
±2  -  0  and  ^  =  1  match  axiom  i=  i  (theorem  nO  in  the  Appendix)  with  substitu¬ 
tion  |0/i2 1  and  {l/i2i  respectively  and  thus  are  primitive  goals  of  type  PI. 
Suppose  that  goals  rg<r1  and  rg>r^  are  taken  as  primitive  goals  of  type  P3-  The 
composition  phase  now  begins.  Subgoals  rQ<r.  A  i2=0  and  rg>r^  A  i2=1  yield 
preconditions  (T  A  ro<rl )  311(1  (1  A  rQ>r1 )  respectively.  A  simplification  pro¬ 
cess  reduces  these  preconditions  to  rg<r^  and  rg>r^  respectively.  The  composed 
substitutions  for  the  immediate  subgoals  of  (1)  are  just  the  unifying  composi¬ 
tions  uc(  { 0/ i2 } ,  {  1)  =  {0/i2 } »  and  uc({l/i2M  1)  =  [l/i2}  respectively.  The 

derived  precondition  of  goal  (1)  is  (rg<r1  V  rg>r1 )  which  simplifies  (via 
theorem  n4)  to  T.  The  composed  substitution  is  the  disjunctive  composition 
{fi2(r0,ri  )/i2}  where 

fi2(Jl,j2)  =  if  Ji<52  then  0  else  1 • 


The  derivation  shows  that  T  is  a  precondition  of 


(ro<r1  A  fi2(r0,r1)-0)  V  (r^  A  fi2(ro»ri  )=1 ) 

i.e.,  that  our  original  goal  is  valid.  Furthermore  we  have  obtained  a  substitu¬ 
tion  term  for  the  one  existentially  quantified  variable  in  (1).  After  requanti¬ 
fying  we  obtain  the  valid  formula: 

Vi0Vii[(i0<ii  A  A.2^0’^1^=<^  ^  (^0^1  A  ^  ^ * 

In  this  example  and  all  that  follow  we  annotate  the  arcs  with  the  name  of 
the  rule  and  theorem  used  and  note  the  primitive  goal  type  of  each  leaf  node. 
Also  in  this  example  we  write  the  simplified  form  of  the  composed  precondition  P 
immediately  under  P.  Hereafter  in  examples  we  will  simply  omit  the  composed 
precondition  in  favor  of  its  simplified  form.  Also  we  omit  substitutions  when 
they  are  inessential  to  an  understanding  of  a  derivation. 

2.6  Formula  Simplification 

Any  deductive  mechanism  needs  a  means  to  simplify  formulas  which  are  gen¬ 
erated  during  the  deductive  process.  Simplification  can  be  usefully  viewed  as 
the  task  of  finding  a  weakest  precondition  (in  all  variables)  of  formula  A.  The 
search  for  a  simple  weakest  precondition  is  kept  short  by  using  only  a  few  of 
the  known  theorems  of  TT.  The  strategy  followed  in  the  examples  is  to  repeat 


<r0<r1  V  rQ>ri>  (ro<rl  A  i2=0)  V  (rQ>ri  A  i2=1 )  Ifi2(i*0»ri  )/i2i 
<T>  {} 


<r0<r1  A  T>  (r0<r!  A  12=0)  {0/ i2 i 

<rn<ri>  U 

0 


<(r0>r1)  A  T>  (rQ>ri  A  i2=1 ) 


<ro>r1  > 


<ro<ri>  ro<ri  n 
H 


<T>  i2=0  |0/i2!  <r0>r1>  r 0>r1  {i 

Pl+nO  ^ 


Figure  1 . 


R1 


<t>  i2=i  n/i2} 

{! 

Pl+nO 


the  following  sequence  of  rule  applications  until  the  goal  has  been  reduced  to 
literals: 

a)  simplify  the  goal  as  much  as  possible  using  known  equivalence  theorems  of  TT, 

b)  multiply  subexpressions  out  using  p9  and  plO  (DeMorgan's  Laws), 

c)  break  the  result  of  (b)  down  to  subexpressions  using  R1  or  R2. 

The  multiplication  step  allows  us  to  mix  preconditions  which  were  returned  from 
different  branches  of  the  goal  tree. 

A  precondition  generating  mechanism  used  for  simplification  purposes  must 
be  carefully  controlled  in  order  to  avoid  infinite  regress.  One  way  around  this 
problem  is  to  prohibit  simplification  of  preconditions  generated  during  the  sim¬ 
plification  process.  Instead  we  check  whether  the  final  derived  precondition  P 
is  simpler  than  the  initial  goal  formula  A.  If  not  then  A  is  returned  otherwise 
we  attempt  to  simplify  P.  If  our  complexity  measuring  function  ranges  over  a 
well-founded  set  then  this  simplification  process  will  terminate. 

Suppose  that  we  need  to  simplify  the  expression 

(i>j  V  i=0)  A  (i< j  V  j=0)  (2) 

where  i  and  j  vary  over  U .  The  derivation  in  figure  2a  yields 

(i>0  A  j=o)  V  i=0 

as  a  weakest  precondition  (i.e.  equivalent  form)  of  (2).  The  derivation  in  fig¬ 
ure  2b  yields 

(i=0  V  j=0)  (3) 

as  a  weakest  precondition.  The  result  is  that  (2)  has  been  simplified  to  (3). 

3.  The  Use  of  Derived  Preconditions  in  Program  Synthesis 

In  this  section  we  show  how  derived  preconditions  can  play  a  central  role 
in  the  design  of  algorithms  [9,10].  Many  of  the  key  steps  in  the  design  process 
involve  finding  a  precondition  of  a  formula  constructed  by  instantiation  of  a 
formula  schema  with  functions,  predicates  and  types  from  the  specification  and 
the  partially  designed  algorithm.  The  resulting  derived  precondition  is  used  to 
either  strengthen  or  complete  some  aspect  of  the  target  algorithm. 

Initially  a  user  supplies  a  complete  formal  specification  of  a  problem 
which  he  desires  to  solve.  The  specification  consists  of  a  naming  of  the  input 


< (i>0  A  3=0)  V  i=0>  (i>j  V  i=0)  A  (i<3  V  3=0) 

^XR5+p9,R2 


<i>0  A  3=0>  i>3  A  (i<3  V  3=0)  <i=0>  i=0  A  (i<3  V  3=0) 

R5+e1 


<i=0>  i=0  A  (o<3  V  3=0) 

R1 


<i=0>  i=0  <T>  0<3  V  3=0 

P3  P1+n2 


P3  P3 

Figure  2a.  First  pass  at  simplifying  goal  formula  (2). 

<i=0  V  3=0>  i=0  V  (i>0  A  3=0) 

R5+p10,R1 


<T>  i=0  V  i>0 
P1+n2 


<i=0  V  3=0>  i=0  V  3=0 

R2 


<i=0>  i=0  <3=0>  3=0 

P3  P3 


Figure  2b.  Second  pass:  simplifying  the  result  of  figure  2a. 

and  output  data  types,  and  two  formulas  called  the  input  and  output  conditions. 
The  types,  functions  and  predicates  involved  in  the  specification  must  be  part 
of  the  language  of  TT.  For  example,  the  problem  of  sorting  a  list  of  natural 
numbers  may  be  specified  as  follows: 

QSORT(x)  =  z  such  that  ORD(z)  A  BAG(x)=BAG(z) 
where  QSORT:  LIST  ( IN)  LIST  (IN). 
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Here  the  input  and  output  types  are  LIST (IN)  (lists  of  natural  numbers).  There 
is  no  input  condition  (except  the  implicit  condition  of  the  input  type)  and  the 
output  condition  is  ORD(z)  A  BAG(x)=BAG(z)  where  ORD(z)  holds  iff  the  list  z  is 
in  nondecreasing  order,  and  BAG(x)=BAG(z)  holds  iff  the  multiset  (bag)  of  ele¬ 
ments  in  x  and  z  is  the  same. 

We  will  construct  a  divide  and  conquer  algorithm  (quicksort)  of  the  form: 
QSORT (x)  =  if 

FRIM(x)  QSORT  :=  f(x)  0 
~PRIM(x)  (x1,x2)  :=  DECOMPOSE(x); 

(zvz2)  :=  (QS0RT(x1),QS0RT(x2)); 

QSORT  :=  C0MP0SE(z1,z2) 
fi 

where  PRIM  is  a  predicate  which  determines  when  to  terminate  recursion,  f  is  a 
function  which  provides  a  solution  for  primitive  inputs,  DECOMPOSE  and  COMPOSE 
are  decomposition  and  composition  functions  respectively.  In  this  program 
schema  PRIM,  f,  DECOMPOSE,  and  COMPOSE  are  uninterpreted  functions  whose  value 
we  have  to  determine.  The  if-fi  construct  is  Dijkstra's  nondeterministic  condi¬ 
tional  statement  [3].  Associated  with  the  algorithm  schema  is  a  correctness 
schema  which  will  be  introduced  later. 

The  first  step  in  the  synthesis  process  involves  the  representation  of  the 
users  problem  by  a  problem  reduction  model  [10].  This  format  extends  the 
specification  of  a  problem  and  restricts  the  type  of  algorithms  which  can  be 
used  to  solve  the  problem  to  one  of  a  small  number  of  algorithms  which  work  by 
problem  reduction.  Eor  present  purposes  the  relevant  parts  of  the  representa¬ 
tion  for  QSCRT  are: 

a)  a  relation  IDR,  called  the  input  decomposition  relation,  which  constrains  the 
way  in  which  input  Xq  can  be  decomposed  into  objects  x^  and  x2  and  serves  as  a 
partial  output  condition  on  subalgorithm  DECOMPOSE  in  the  divide  and  conquer 
schema: 

^(xQfX^  ,x2)  -  BAG(xq)=BAG(x1  )  UBAG(x2) 
where  31  UR?  denotes  the  bag-union  of  bags  3«  and  B2- 

b)  a  relation  OCR,  called  the  output  composition  relation,  which  constrains  the 


way  in  which  output  object  z q  can  be  formed  from  objects  Zf  and  z2  and  serves  as 
a  partial  output  condition  on  the  subalgorithm  COMPOSE: 

0CR(zo,z1 ,z2)  m  BAG(zq)=BAG(z1  ) UBAG(z2) 

c)  a  well-founded  ordering  relation  y  on  LIST(H)  is  used  to  ensure  that  the 
target  program  terminates  on  all  inputs: 

x0yx1  m  LG(xq)>LG(x1  ) 

where  the  function  Ifi(x)  returns  the  length  of  the  list  x. 

3*1  Checking  and  Enforcing  Compatibility  in  the  Representation 

The  representation  of  the  user's  problem  by  a  problem  reduction  model  is 
constructed  by  heuristic  means.  A  formula  expressing  the  mutual  compatibility 
of  various  parts  of  the  model  is  constructed  and  an  attempt  is  made  to  verify 
it.  If  the  derived  precondition  P  is  T  then  the  parts  are  compatible  otherwise 
we  lose  P  to  modify  the  model  to  ensure  compatibility.  For  example  we  want  the 
input  decomposition  relation  IDR  to  be  compatible  with  the  well-founded  ordering 
>• ,  in  the  sense  that 

VxoV^Vx2  [WR(x0,x1  ,X2)  =»  Xq  >*xi  A  ^>-x2] 

i.e.,  if  Xq  can  decompose  into  lists  x^  and  x2  then  x^  and  x>>  must  both  be 
smaller  than  xq  under  the  y  relation.  After  substituting  in  the  form  of  IDR 
and  the  well-founded  ordering  for  the  QSORT  example,  and  preparing  the  formula 
we  obtain  the  goal: 

BAG(a0)=BAG(a1 )  UBAG^)  =*  LG(a0)>LG(a1 )  A  LCKa^XLG^)  (4) 

where  ,  and  a2  are  skolem  constants  for  the  (universally  quantified) 

variables  Xq,  x1 ,  X2*  The  derivation  of  a  XqX1 X2~precondition  of  (4)  is  given 
in  figure  3*  The  resulting  precondition  is 

BAG(x0)=BAG(x1)UBAG(x2)  =»  LG(x1  )>0  A  LG(x2)>0 

which  means  that  IDR  is  not  strong  enough  to  imply  the  consequent  of  the  origi¬ 
nal  goal.  Prom  the  definition  of  preconditions  it  follows  that  the  conjunction 
of  IDR  and  the  derived  precondition  will  in  fact  imply  the  consequent  of  (4). 


BAG(xq)=BAG(x1)UBAG(x2)  =»  LG(xq)>LG(x1  )  A  LG(x0)>LG(x2) 

R8a 

<Q>  LG(xd)>LG(x1  )  A  LG(xd)>LG(x2) 
jBAG(x0)=BAG(x1 )  UBAG(x2)  ! 


<Q2>  LG(xo)>LG(x2) 
{BAG(x0)=BAG(x1 ) UBAG(x2) } 

I R7+lb2 


<Q1 >  LG(xo)>LG(Xl ) 
|BAG(xq)=BAG(xi  )  UBAG(x2)  j 

R7+lb2 

<Q-)  >  LG(xo)>LG(Xl ) 

H 

R9 

<Q^  >  LG(xi )+LG(x2)>LG(x1 ) 
H 

R5+n6 

<Q, >  LG(x2)>0 
H 

R8b 

<Qi  >  Qi 

H 

P3 


<Q2>  I/}(xq)>IG(x2) 

H 

R9 

<Q?>  LG(xt )+LG(x2)>LG(x2) 
H 

R5-m6 

<Q2>  IG(x^)>0 
H 

R8b 

<Qp>  Qp 

H 

P3 


Q1  is  BAG(x0)=BAG(x1 )  UBAGtxg)  =*>  LG(x2)>0 
Q2  is  BAG(xg)=BAG(x1 )  UBAG(x1 )  =»LG(x2)>0 
Q  is  3AG(x0)=BAG(x1 ) UBAG(x2)  =*  (LG(x2)>0  A  LG^  )>0) 
H  =  jBAG(xQ)=BAG(x1)UBAG(x2),LG(x0)=LG(x1)+LG(x2)i 


Figure  3-  Checking  Compatibility  of  IDR  and  > 


Thus  we  can  form  a  new  strengthened  input  decomposition  relation  IDR'  where 
HJR'  (x0,x1  ,x2)  -IDR(x0,x1  ,x2)  A[BAG(x0)=BAO(x1  )  UBAG(x2)  =»  LG(x1  )>0ALG(x2)>0] 


The  derivation  in  figure  3  quarantees  that  IDR'  is  compatible  with  the  well- 
founded  ordering.  After  simplifying  IDR'  we  have 

IDR'(x0,x1,x2)  a  BAG(xq)=BAG(x1 ) UBAG(x2)  A  LG(x1  )>0  ALG(x2)>0. 


3-2  Reducing  a  Quantified  Predicate  to  a  Target  Language  Expression 

The  predicate  PRIM(x)  in  the  divide  and  conquer  schema  is  intended  to  dis¬ 
tinguish  nondecomposable  from  decomposable  inputs.  In  the  QSORT  example  it  is 
stiff icient  for  -PRIM(xq)  to  be  a  XQ-precondition  of 

Vx03x1  3x2  IDR'(x0,x1  ,X2) 

i.e.  a  list  is  decomposable  only  if  there  are  lists  into  which  it  can  decompose. 
The  deduction  in  figure  4  yields  the  precondition  LG(aQ)>1  and  after  some  simple 
manipulations  LG(x)<1  and  LG(x)>1  can  be  substituted  for  PRIM(x)  and  ~PRIM(x) 
respectively  in  QSORT.  One  additional  mechanism  is  needed  to  correctly  handle 
this  example.  The  reduction/composition  rule  R1  treats  each  subgoal  indepen¬ 
dently  and  combines  the  returned  substitutions  into  their  unifying  composition. 
This  treatment  does  not  work  well  when  the  subgoals  have  common  variables.  Most 
theorem  proving  systems  allow  substitutions  in  one  subgoal  to  be  applied  to  the 
other  (since  different  substitutions  may  be  found  independently  for  the  same 
variable)  and  we  follow  this  practice  here. 

3«3  Simple  Code  Generation  through  Substitution  of  a  Term  for  an  Output  Vari- 
able. 


With  the  PRIM  predicate  in  hand  the  synthesis  process  can  proceed  to  the 
task  of  finding  a  target  language  expression  to  handle  primitive  inputs  in  the 
quicksort  algorithm.  A  correctness  formula  for  the  primitive  branch  of  the 
quicksort  algorithm  is: 


Vx3z[LG(x)<1  =»  ORD(z)  A  PERM(x.z)]. 

The  deduction  in  figure  5  shows  that  T  is  a  xz-precondition  of  this  formula  thus 
proving  its  validity  in  TT.  The  substitution  gives  us  a  value  for  z  for  any  x, 


A 

R6+lb9 

<LG(aQ)>1>  aQsconsCj^  cons(j2»  append (w1  ,w2) ) ) 

R5+lb10 

<LG(a0)>1>  LG(a0)>1 
P3 


where  9^  =  {cona( )/x^  |  and  02=  jcons( j2,w2)/x2l 

Figure  4.  Generating  a  target  language  expression  for  -PRIM 


<T>  LG(a)<1  =»  ORD(z)  A  BAG(a)=BAG(z)  ja/z} 

I 

;R8a 

<T>  ORD(z)  A  BAG(a)=BAG(z)  {a/z} 


<T>  ORD(z)  {a/z! 
{Ifi(a)<1  j 


/ 


<T>  BAG(a)=BAG(z)  {a/z{ 
{LG(a)£1  } 

PI 


R6+lb3 


<T>  LG(z)<1  {a/zj 
{ifi(^<i ! 
pi 


Figure  5*  Finding  a  target  language  term 


namely  x  itself.  Thus  the  primitive  branch  of  our  quicksort  is  completed  since 
x  is  the  desired  output  value.  The  target  algorithm  now  has  the  form 

QSORT(x)  *  if 

LG(x)<1  -»  QSORT  :=  x  0 
LG(x)>1  .  .  . 

fi 


3.4  Completion  of  the  Partial  Specification  of  a  Subalgorithm 

The  next  step  in  the  synthesis  provides  our  final  example  and  completes  the 
construction  of  the  top  level  algorithm  for  QSORT.  The  nonprimitive  branch  of 
QSORT  has  two  uninterpreted  functions  COMPOSE  and  DECOMPOSE  which  have  partial 
specifications  based  on  OCR  and  IDR  respectively.  We  look  for  a  known  target 
language  function  satisfying  either  partial  specification  and  find  that  the 
function  APPEND,  which  appends  one  list  onto  the  end  of  another,  satisfies  the 
(partial)  specification  for  COMPOSE.  The  algorithm  schema  then  becomes: 
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QSORT(x)  =  if 

LG(x)<1  QSORT  :=  x  0 

LG(x)>1  -4  (x^x^  :=  DECOMPOSE(x); 

(z1,z2)  :=  (QS0RT(x1),QS0RT(x2)); 

QSORT  :  =  APPEND (z.j  ,z£) 
fi 

where  subalgorithm  DECOMPOSE  remains  to  be  synthesized  and  has  partial  specifi¬ 
cation 

DECOMPOSE(x)  =  (x1  .Xg)  such  that  [LG(x)>1  =»  (BAG(x)=RAG(x1 )  UBAG^)  A 

LGCx^X)  A  LG(X2)>0)] 

where  DECOMPOSE:  LISTON)  -»  LIST(]N)2. 

The  concern  now  is  to  find  any  additional  output  conditions  needed  by  DECOMPOSE 
in  order  to  make  QSORT  satisfy  its  formal  specifications.  A  sufficient  condi¬ 
tion  for  the  total  correctness  of  QSORT  [10]  is: 

VxqVx-i  Vx2Vz0Vzi  Vz2  [[  BAG(xq)  =  BAGCx^  U  BAG(x2)  A 

LG(Xl  )>0  A  LG(x2)>0  A 
BAG^)  =  BAG^)  a  0RD(z1)  a 

BAG( X2 )  =  BAG(z2)  A  0RD(z2)  A 

z0  =  APPMD(z1  ,z2)]  =>  (BAG(xq)  =  BAG(Z0)  A  0RD(zq))] 

(6) 

If  (6)  is  not  valid  it  is  because  the  specification  of  DECOMPOSE  is  too  weak. 
We  seek  therefore  a  xqX1 x2-precondition  of  (6)  and  add  it  to  the  output  specifi¬ 
cation  of  DECOMPOSE.  Preparing  (6)  results  in  the  substitution  of  skolem  con¬ 
stants  a^.b.]  ,b2»CQ,c^  ,C2  for  xq,x.|  ,x2,Zq,z^  ,Z2  respectively.  Let  H  denote  the 
set  of  conjuncts  in  the  antecedent  of  the  prepared  correctness  formula  and  A  the 
consequent.  An  expression  of  the  form  P(ALL(3))  will  be  used  to  abbreviate 
Vx®B  P(x)  where  B  is  a  bag  variable.  The  derivations  given  in  figures  6a  and 
6b  yield 

ALL(BAG(x1  ) )<ALL(BAG(x2) ) • 

Strengthening  DECOMPOSE  with  this  precondition  we  obtain  the  complete  specifica¬ 
tion 


<T>  BAG(a0)=BAff(c0) 

lc0=APPSND(c1  ,c2)}  UH 

R9 

<T>  BAG(a0)=BAG(APPEND(c1 ,c9)) 

H 

|R9+lb5 

<T>  BAG(a0)=BAG(c;! )  UBAG(c2) 
{BAG^  )=BAG(c1  ),BAG(b2)=BAG(c2)}  UH 

|r9 

<T>  3AG(a0)=BAG(b1 ) UBAG(b2) 
iBAG(a0)=BAG(b1 ) UBAG(b2)| 

PI 


Figure  6a.  Nonprimitive  branch  of  QSORT 


<P>  0RD(c0) 
ic0=APPBn)(c1  ,c2)j  UH 


<P>  ORD ( APPEND ( c1  ,c2)) 


R9 


H 


<P>  AIL(BAG(b1  ))<ALL(BAG(b2)) 


H 


<?>  ~H  V  ? 
P3 


where  ?  is  ALL(BAG(b1 )  )<_ALL(3AG(b2) ) 

Figure  6b.  Completing  the  specification  of  DECOMPOSE 
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DECOMPOSER )  =  (x1  ,x2)  such  that  [LG(x)>1  =»  (BAG(x)=BAG(x1 )  U  BAG(x2)  A 
LGR^X)  A  LG(x2)>0  A  ALKBAG^  ))<ALL(BAG(x2))] 
where  DECOMPOSE:  LIST  (IN)  -4  LIST  (ft)2. 

The  synthesis  process  is  then  recursively  invoked  to  design  an  algorithm  meeting 
these  specifications. 

The  synthesis  system  from  which  we've  drawn  the  examples  is  an  attempt  to 
obtain  increased  synthesis  performance  by  1 )  dividing  the  synthesis  task  into  a 
number  of  relatively  small  deductive  tasks,  and  2)  using  large  amounts  of 
knowledge  about  programming.  The  system  makes  use  of  two  types  of  programing 
knowledge:  1)  control  strategy  knowledge  encoded  by  program  schemas  (such  as  the 
schema  for  divide  and  conquer  used  above)  and  their  associated  correctness  sche¬ 
mas,  and  2)  data  structure  knowledge  represented  in  part  by  the  known  theorems 
of  TT.  Other  recent  deductive  approaches  to  program  synthesis  [1,4,6]  also  make 
use  of  data  structure  knowledge,  but  have  different  approaches  to  representing 
control  knowledge  and  tend  to  construct  programs  on  the  basis  of  a  single  large 
deductive  task. 

4.  Conclusion 


In  this  paper  we  have  defined  a  new  deductive  problem,  that  of  find  ti  g  a 
precondition  of  a  given  formula,  and  presented  a  formal  system  wi which 
preconditions  can  be  derived.  We  have  tried  to  convey  a  sense  of  the  flexibil¬ 
ity  and  usefulness  of  such  a  system  through  a  number  of  examples  drawn  from  the 
domain  of  program  synthesis.  We  are  currently  implementing  a  system  based  on 
the  one  described  here  and  hope  to  report  on  such  issues  as  formula  complexity 
measures  and  control,  which  we  have  largely  ignored  here,  in  a  future  paper. 


APPMDIX 


Listed  below  are  the  known  theorems  used  in  the  examples  of  this  paper.  It  is 
important  that  these  assertions  are  expressed  in  their  strongest  form  (i.e.,  as 
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equivalences  rather  than  implications)  whenever  possible,  so  that  it  can  be 
determined  whether  a  weakest  precondition  has  been  derived  or  not.  Often  a 
theorem  is  used  in  one  direction  only  although  it  may  be  stated  as  an 
equivalence . 

Propositional  theorems 

pi.  A  V  ~A 
p2.  ~(A  A  ~A) 

P3.  T  A  A  a  A 

p4.  T  V  A  *  I 

p5.  F  A  A  a  F 

p6.  F  V  A  a  A 

p7.  ~(A  A3)  as  ~A  \J  ~B 

p8.  ~(A  V  3)  as  ~A  A  ~B 

p9-  A  A  (B  V  C)  =s  (A  A  B)  V  (A  A  C) 

plO.  A  V  (B  A  C)  »  (A  V  3)  A  (A  V  C) 

pll  .  (A  B)  as  (~  A  V  B) 

p12.  A  V  (A  A  B)  ss  A 

pi  2.  A  A  (A  V  B)  ss  A 

Equality  theorems 

el .  P(x)  A  x=y  ■  P(y)  A  x=y  where  P(x)  is  a  formula  depending  on  term  x. 

Natural  number  theorems 

Let  i,  j  ,k  denote  variables  of  type  21. 

nO.  i=i 

nl .  i >0 

n2.  i=0  V  i>0 

n3-  i£j  V  i>.1 

n4.  i<j  V  i >J 

n5-  ~( i<j  A  i>J) 

n6.  i+j>i  -  j>0 

n7-  ~(i>k)  »  i<k 

n8.  ~(i<k)  ss  i>k 

n9-  i>k1  A  j>k2  i+j>k1-tk2+1 


List  and  Bag  theorems 

Let  wg, w.|  ,W£  vary  over  LIST(  H ) ,  and  let  ,B2  vary  over  EAGS(B). 

lbl  .  Wg  =  Wg 

lb2.  3AG(wg)=BAG(w-j )  (J  BAG(w2)  IGr(vfg)=IXj(w^  )+LG(w2) 
lb?.  LG(wg)<1  =*>  ORD(Wg) 

lb4.  [0RD(wt)  A  0RD(w2)  A  ALL(BAG(wt ))<ALL(BAG(w2))]  ■  ORD ( APPEND ( w1  ,v2) ) 

lb5.  BAG  ( APPEND  (wg,w.j ) )  =  3AG(w0)  U  BAG(w1 ) 
lb6.  =B1 

lb7.  { i1 }  Ul^l  =  Ui  A2I 
lb8.  B1  UB2  =  B2UB1 

lb9.  w1  = cons(ig,  cons(ii , . . .cons(in,w2) . • •) )  =*  BAG^  )  =  {ig,^  , . . .  ,in}  l|BAG(w2) 
lblO.  Wg=  cons(ig,oons(i-| , . .  .cons(in,w.| ) . . . ) )  =  LG(wg)>n 
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